Asahi Suffers Major Cyberattack, Compromising 2 Million Records; No Ransom Paid, Recovery Underway

November 27, 2025
Asahi Suffers Major Cyberattack, Compromising 2 Million Records; No Ransom Paid, Recovery Underway
  • CEO Katsuki indicated the mid-to-long-term management plan remains intact despite expectations of weaker near-term results.

  • Company president Atsushi Katsuki publicly apologized at a Tokyo press conference and acknowledged the cyberattack caused significant system disruption across beer, beverages, and food logistics.

  • Katsuki emphasized that no ransom was paid, no attackers were contacted, and the company is strengthening risk management and addressing vulnerabilities that were exposed by the breach.

  • A major cyberattack on Asahi Group Holdings Ltd. disclosed that personal data of nearly 2 million people was compromised, with the incident commencing on September 29 and triggering a multi-month system failure.

  • December plans include restoring automated orders and shipments, while current operations proceed manually during the rebuild.

  • The company isolated the compromised datacenter within hours and is restoring systems in phases, with gradual shipment resumption as security validation proceeds; full normalization may delay earnings disclosures.

  • Although automation and order placement are to resume in December, full shipment resumption for all products may take longer as systems are phased back online.

  • The disruption affected external beer suppliers and broader industry by causing supply instability, shipping restrictions, and year-end sales suspensions.

  • Asahi reports no ransom payments and notes ongoing efforts to strengthen risk management and address vulnerabilities, which have been tackled.

  • The company aims to normalize logistics by February 2026, with automated ordering resuming in December and a staged restoration of shipments as systems are validated for security.

  • About 30 domestic factories halted orders, production, and shipments since late September, with manual processing in place and only partial production resuming.

  • There has been no public confirmation of data publication; containment and phased restoration continue.

Summary based on 9 sources


Get a daily email with more Cybersecurity stories

More Stories